Dostly Privacy Policy

Last updated: 19 October 2026

Who is responsible

Marek Pluta (Poland), contact: hello@marekpluta.com. I am the controller of the data of merchants who install the app. I process buyer data as a processor, on the instructions of the merchant, who remains its controller; section 6 of the terms of service sets out the rules.

What data and why

• Store domain, Shopify access token, app settings and simple pickup statistics, and when the merchant provides them: the shipment sender details and encrypted keys to its carrier and Base accounts: running the app (Art. 6(1)(b) GDPR). The app cannot work without access to the store.
• IP address of requests to the server: protection against abuse (Art. 6(1)(f) GDPR), kept in memory for at most 2 minutes.
• Buyer data, on the merchant's instructions:
  • postal code, cart value and optionally the device location the buyer allows in the browser: finding pickup points and calculating the rate;
  • the chosen point: saving it on the Shopify order and, when the merchant connects Base, in Base;
  • name, delivery address, phone and email: creating a shipment when the merchant orders it, and checking whether recent orders have this data;
  • email: one reminder to choose a point, when the merchant turns reminders on.
  I do not store buyer contact data; the database keeps only the order number, the shipment number, the chosen point and the status of the reminder and of the Base entry.

The data comes from the merchant, from Shopify or from the buyer. I do not sell it, use it for advertising or profiling, or make solely automated decisions.

Recipients

Shopify (store and billing platform), OVHcloud (server in the European Economic Area) and Cloudflare (network and server protection and sending reminders, may process data outside the EEA under the EU-US Data Privacy Framework or standard contractual clauses; I will send a copy of these safeguards on request). OVHcloud and Cloudflare are my sub-processors for buyer data.

When the merchant orders a shipment, I send the buyer's data to the carrier the merchant chose (InPost, ORLEN Paczka, Poczta Polska, GLS, DPD or DHL), and when the merchant connects Base, I send it the order number and the point; both act under their agreements with the merchant. By default the buyer's browser loads the point map from the OpenStreetMap Foundation (United Kingdom, European Commission adequacy decision, Art. 45 GDPR); the merchant may choose another map, e.g. Google, and then informs buyers about it. When the local point list is not enough, the server asks InPost and GLS for points using only the postal code or coordinates.

I disclose data to public authorities only when the law requires it.

Retention

For as long as the app is used. On uninstall I delete the access token at once, and the rest automatically after the shop deletion request that Shopify usually sends 48 hours later. Reminder and Base entries are deleted automatically after 30 days. Encrypted backups expire within 16 days at the latest. I handle buyer requests through the merchant: when Shopify forwards an access request, I send the merchant the data I store within 30 days, and I delete it automatically on a deletion request.

Your rights

Where I am the controller: access, rectification, erasure, restriction, portability and objection. You may also complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych).

Cookies and changes

The app does not use cookies for analytics or advertising; this page only remembers the chosen theme in the browser. I notify merchants of material changes, and the current version is always on this page.